3 ms·
But why? What does it get you? An audit doesn't prove the absence of bugs. It doesn't change the fact that you should assume vulnerability and use defense in d
by tedks 12y ago
But why? What does it get you?
An audit doesn't prove the absence of bugs. It doesn't change the fact that you should assume vulnerability and use defense in depth. It doesn't actually tell anyone that they're more or less safe.
And why Truecrypt? Why not any other crypto program? Why not one that was maintained and had a future? Wouldn't it be more worth it to donate that money to ensure that the people who use GPG know how safe they are? Or OpenSSL?
I think the real reason why Truecrypt got so much attention is that it A.) ran on windows + had visible source and thus was possible to be audited, and B.) had anonymous devs shrouded in interesting secrecy. If Truecrypt was linux-only and was developed by Jorge Schmorge in his off-time from Startuply, it wouldn't have gotten any burning desires to audit it.
Can you explain more what convinced you to spend time and money on this? What makes this more valuable than 70 Watsi patients?
Also, could you respond to my comment here: https://news.ycombinator.com/item?id=9312559 https://news.ycombinator.com/item?id=9312559
- tptacek 12y agoBy this logic, all my money should go to Watsi patients. I don't think the Truecrypt audit was the most important thing to allocate my resources towards, but it was worthy of the resources I allocated to it.
- tedks 12y agoThat's not necessarily true -- I think you could very convincingly argue that a secure Truecrypt is more valuable than some number of Watsi patients. What if Truecrypt allows a journalist to expose some corruption that saves or benefits some equivalent number of lives? By allocating resources you are implicitly deciding that the target of your allocation is the most important thing to allocate your resources towards. I don't see how this could not be the case.